@hunter-harness/workflow-harness 0.2.44 → 0.2.46

package/harness/bundles/general/cursor/scripts/harness_archive.py

@@ -1963,6 +1963,7 @@ def validate_sensitive_evidence_publication_gate(
     *,
     copy_root: Path | None = None,
     require_receipt: bool = False,
+    receipt_override: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Fail closed before freeze/copy when plaintext evidence is unresolved.
 
@@ -1983,7 +1984,7 @@ def validate_sensitive_evidence_publication_gate(
             "unresolvedFailures": candidates,
             "nextAction": "Quarantine the original bytes before archive publication.",
         }
-    if not receipt_path.is_file():
+    if receipt_override is None and not receipt_path.is_file():
         if require_receipt:
             return {
                 "ok": False,
@@ -1998,15 +1999,18 @@ def validate_sensitive_evidence_publication_gate(
             "receiptRequired": False,
             "unresolvedFailures": [],
         }
-    try:
-        receipt = read_json(receipt_path)
-    except (OSError, json.JSONDecodeError, TypeError) as exc:
-        return {
-            "ok": False,
-            "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
-            "receiptPath": str(receipt_path),
-            "error": str(exc),
-        }
+    if receipt_override is None:
+        try:
+            receipt = read_json(receipt_path)
+        except (OSError, json.JSONDecodeError, TypeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = receipt_override
     if not isinstance(receipt, dict):
         return {
             "ok": False,
@@ -7463,10 +7467,35 @@ def cmd_finalize(
         payload["error"] = f"archive target already exists: {archive_dir}"
         return 1, payload
 
+    source_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+        original_change_dir,
+        persist=False,
+    )
+    payload["steps"]["sensitive_evidence_source_refresh"] = source_sensitive_refresh
+    if not source_sensitive_refresh.get("ok"):
+        payload["error"] = str(
+            source_sensitive_refresh.get("error")
+            or "sensitive evidence source receipt refresh failed"
+        )
+        payload["issues"] = [
+            {
+                "code": str(
+                    source_sensitive_refresh.get("reasonCode")
+                    or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                ),
+                "severity": "error",
+                "message": payload["error"],
+            }
+        ]
+        payload["original_preserved"] = original_change_dir.is_dir()
+        payload["finalStatus"] = "FAIL"
+        return 1, payload
+
     source_sensitive_gate = validate_sensitive_evidence_publication_gate(
         original_change_dir,
         copy_root=original_change_dir,
-        require_receipt=False,
+        require_receipt=True,
+        receipt_override=source_sensitive_refresh.get("receipt"),
     )
     payload["steps"]["sensitive_evidence_source_gate"] = source_sensitive_gate
     if not source_sensitive_gate.get("ok"):
@@ -7580,9 +7609,38 @@ def cmd_finalize(
     # receipt in the isolated staging tree.  This keeps legacy archives
     # compatible while making every published archive auditable.
     try:
-        staged_receipt = hruntime.sensitive_evidence_receipt_path(work_dir)
-        if not staged_receipt.is_file():
-            hruntime.ensure_sensitive_evidence_scan_receipt(work_dir)
+        # Split-v1 runtime state becomes part of the publishable archive.  Merge
+        # it before the final scan so no late runtime byte can bypass the
+        # sensitive-evidence gate or invalidate the receipt digest.
+        if split_state_dir is not None and split_state_dir.is_dir():
+            _merge_runtime_state(split_state_dir, work_dir)
+            payload["steps"]["split_state_merge"] = {
+                "ok": True,
+                "stateDir": str(split_state_dir),
+            }
+        staged_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+            work_dir
+        )
+        payload["steps"][
+            "sensitive_evidence_staging_refresh"
+        ] = staged_sensitive_refresh
+        if not staged_sensitive_refresh.get("ok"):
+            payload["error"] = str(
+                staged_sensitive_refresh.get("error")
+                or "sensitive evidence staging receipt refresh failed"
+            )
+            payload["issues"] = [
+                {
+                    "code": str(
+                        staged_sensitive_refresh.get("reasonCode")
+                        or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                    ),
+                    "severity": "error",
+                    "message": payload["error"],
+                }
+            ]
+            _restore_finalize_failure()
+            return 1, payload
         staged_sensitive_gate = validate_sensitive_evidence_publication_gate(
             work_dir,
             copy_root=work_dir,
@@ -7608,13 +7666,6 @@ def cmd_finalize(
         _restore_finalize_failure()
         return 1, payload
 
-    if split_state_dir is not None and split_state_dir.is_dir():
-        _merge_runtime_state(split_state_dir, work_dir)
-        payload["steps"]["split_state_merge"] = {
-            "ok": True,
-            "stateDir": str(split_state_dir),
-        }
-
     def _safe_append(**kwargs: Any) -> None:
         nonlocal work_dir
         try:

package/harness/bundles/general/cursor/scripts/harness_runtime.py

@@ -217,7 +217,7 @@ def sensitive_evidence_candidates(root: Path) -> list[dict[str, Any]]:
     return _sensitive_candidates(root)
 
 
-def _write_sensitive_scan_receipt(
+def _build_sensitive_scan_receipt(
     change_root: Path,
     *,
     entries: list[dict[str, Any]],
@@ -225,7 +225,7 @@ def _write_sensitive_scan_receipt(
     status: str,
 ) -> dict[str, Any]:
     change_root = change_root.expanduser().resolve()
-    receipt = {
+    return {
         "schemaVersion": 1,
         "rulesVersion": SECRET_SCAN_RULES_VERSION,
         "changeId": change_root.name,
@@ -236,6 +236,22 @@ def _write_sensitive_scan_receipt(
         "publicationExcluded": True,
         "recordedAt": now_iso(),
     }
+
+
+def _write_sensitive_scan_receipt(
+    change_root: Path,
+    *,
+    entries: list[dict[str, Any]],
+    unresolved: list[dict[str, Any]],
+    status: str,
+) -> dict[str, Any]:
+    change_root = change_root.expanduser().resolve()
+    receipt = _build_sensitive_scan_receipt(
+        change_root,
+        entries=entries,
+        unresolved=unresolved,
+        status=status,
+    )
     atomic_write_json(_sensitive_evidence_receipt_path(change_root), receipt)
     return receipt
 
@@ -364,6 +380,93 @@ def ensure_sensitive_evidence_scan_receipt(change_root: Path) -> dict[str, Any]:
     )
 
 
+def refresh_sensitive_evidence_scan_receipt(
+    change_root: Path,
+    *,
+    persist: bool = True,
+) -> dict[str, Any]:
+    """Rescan current bytes while preserving valid quarantine audit entries."""
+    change_root = change_root.expanduser().resolve()
+    receipt_path = _sensitive_evidence_receipt_path(change_root)
+    entries: list[dict[str, Any]] = []
+    if receipt_path.is_file():
+        try:
+            prior = json.loads(receipt_path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+        if not isinstance(prior, dict):
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": "receipt must be an object",
+            }
+        prior_entries = prior.get("entries")
+        prior_unresolved = prior.get("unresolvedFailures")
+        valid_identity = (
+            prior.get("schemaVersion") == 1
+            and prior.get("rulesVersion") == SECRET_SCAN_RULES_VERSION
+            and prior.get("changeId") == change_root.name
+            and prior.get("publicationExcluded") is True
+            and str(prior.get("status") or "").upper()
+            in {"OK", "QUARANTINED", "FAIL"}
+        )
+        if (
+            not valid_identity
+            or not isinstance(prior_entries, list)
+            or not isinstance(prior_unresolved, list)
+        ):
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": "receipt identity or collection fields are invalid",
+            }
+        entries = list(prior_entries)
+
+    unresolved = _sensitive_candidates(change_root)
+    status = "FAIL" if unresolved else "QUARANTINED" if entries else "OK"
+    if persist:
+        try:
+            receipt = _write_sensitive_scan_receipt(
+                change_root,
+                entries=entries,
+                unresolved=unresolved,
+                status=status,
+            )
+        except OSError as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_REFRESH_FAILED",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = _build_sensitive_scan_receipt(
+            change_root,
+            entries=entries,
+            unresolved=unresolved,
+            status=status,
+        )
+    return {
+        "ok": not unresolved,
+        "reasonCode": (
+            "SENSITIVE_EVIDENCE_UNQUARANTINED"
+            if unresolved
+            else "SECRET_SCAN_RECEIPT_REFRESHED"
+        ),
+        "receiptPath": str(receipt_path),
+        "receipt": receipt,
+        "persisted": persist,
+        "unresolvedFailures": unresolved,
+    }
+
+
 def _run_sessions_root(state_root: Path) -> Path:
     return state_root.expanduser().resolve() / "runtime" / "run-sessions"
 

package/harness/bundles/java/claude-code/.harness-build.json

@@ -2,5 +2,5 @@
   "schemaVersion": 1,
   "overlay": "java",
   "agent": "claude-code",
-  "coreHash": "55942841a9d47387"
+  "coreHash": "769659e013ca1779"
 }

package/harness/bundles/java/claude-code/harness-apidoc/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-apidoc — 前端接口文档（Java overlay）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-archive/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-archive — 变更归档
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-codebase-map/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-codebase-map — 代码库地图
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-knowledge-ingest/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-knowledge-ingest
 
 从 `.harness/archive/**/reports/final/summary-data.json` 抽取项目知识，生成并维护本地 `.harness/knowledge/` 索引。

package/harness/bundles/java/claude-code/harness-knowledge-query/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-knowledge-query
 
 并行 change 中查询必须传 `--change <change-id>`；成功后以该 change 的 `meta/knowledge-context.json` 为稳定指针。全局 `context-packs/latest.json` 仅向后兼容，不得用于判断多个 active change 的上下文归属。

package/harness/bundles/java/claude-code/harness-package/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-package — 增量模块打包（Java overlay）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-plan/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-plan — 需求规划
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-review/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-review — 代码审查
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-run/SKILL.md

@@ -21,7 +21,7 @@ disallowed-tools:
   - Bash(curl *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-run — 需求编码
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-submit/SKILL.md

@@ -20,7 +20,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-submit — 最终提交（含 worktree 合并）
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-sync/SKILL.md

@@ -19,7 +19,7 @@ disallowed-tools:
   - Bash(awk *)
   - Bash(curl *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-sync
 
 ## Purpose

package/harness/bundles/java/claude-code/harness-test/SKILL.md

@@ -22,7 +22,7 @@ disallowed-tools:
   - Bash(node *)
   - Bash(codegraph *)
 ---
-<!-- generated by harness_deploy.py; core=55942841a9d47387; overlay=java; agent=claude-code; do not edit -->
+<!-- generated by harness_deploy.py; core=769659e013ca1779; overlay=java; agent=claude-code; do not edit -->
 # harness-test — 测试执行
 
 ## Purpose

package/harness/bundles/java/claude-code/scripts/harness_archive.py

@@ -1963,6 +1963,7 @@ def validate_sensitive_evidence_publication_gate(
     *,
     copy_root: Path | None = None,
     require_receipt: bool = False,
+    receipt_override: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Fail closed before freeze/copy when plaintext evidence is unresolved.
 
@@ -1983,7 +1984,7 @@ def validate_sensitive_evidence_publication_gate(
             "unresolvedFailures": candidates,
             "nextAction": "Quarantine the original bytes before archive publication.",
         }
-    if not receipt_path.is_file():
+    if receipt_override is None and not receipt_path.is_file():
         if require_receipt:
             return {
                 "ok": False,
@@ -1998,15 +1999,18 @@ def validate_sensitive_evidence_publication_gate(
             "receiptRequired": False,
             "unresolvedFailures": [],
         }
-    try:
-        receipt = read_json(receipt_path)
-    except (OSError, json.JSONDecodeError, TypeError) as exc:
-        return {
-            "ok": False,
-            "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
-            "receiptPath": str(receipt_path),
-            "error": str(exc),
-        }
+    if receipt_override is None:
+        try:
+            receipt = read_json(receipt_path)
+        except (OSError, json.JSONDecodeError, TypeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = receipt_override
     if not isinstance(receipt, dict):
         return {
             "ok": False,
@@ -7463,10 +7467,35 @@ def cmd_finalize(
         payload["error"] = f"archive target already exists: {archive_dir}"
         return 1, payload
 
+    source_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+        original_change_dir,
+        persist=False,
+    )
+    payload["steps"]["sensitive_evidence_source_refresh"] = source_sensitive_refresh
+    if not source_sensitive_refresh.get("ok"):
+        payload["error"] = str(
+            source_sensitive_refresh.get("error")
+            or "sensitive evidence source receipt refresh failed"
+        )
+        payload["issues"] = [
+            {
+                "code": str(
+                    source_sensitive_refresh.get("reasonCode")
+                    or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                ),
+                "severity": "error",
+                "message": payload["error"],
+            }
+        ]
+        payload["original_preserved"] = original_change_dir.is_dir()
+        payload["finalStatus"] = "FAIL"
+        return 1, payload
+
     source_sensitive_gate = validate_sensitive_evidence_publication_gate(
         original_change_dir,
         copy_root=original_change_dir,
-        require_receipt=False,
+        require_receipt=True,
+        receipt_override=source_sensitive_refresh.get("receipt"),
     )
     payload["steps"]["sensitive_evidence_source_gate"] = source_sensitive_gate
     if not source_sensitive_gate.get("ok"):
@@ -7580,9 +7609,38 @@ def cmd_finalize(
     # receipt in the isolated staging tree.  This keeps legacy archives
     # compatible while making every published archive auditable.
     try:
-        staged_receipt = hruntime.sensitive_evidence_receipt_path(work_dir)
-        if not staged_receipt.is_file():
-            hruntime.ensure_sensitive_evidence_scan_receipt(work_dir)
+        # Split-v1 runtime state becomes part of the publishable archive.  Merge
+        # it before the final scan so no late runtime byte can bypass the
+        # sensitive-evidence gate or invalidate the receipt digest.
+        if split_state_dir is not None and split_state_dir.is_dir():
+            _merge_runtime_state(split_state_dir, work_dir)
+            payload["steps"]["split_state_merge"] = {
+                "ok": True,
+                "stateDir": str(split_state_dir),
+            }
+        staged_sensitive_refresh = hruntime.refresh_sensitive_evidence_scan_receipt(
+            work_dir
+        )
+        payload["steps"][
+            "sensitive_evidence_staging_refresh"
+        ] = staged_sensitive_refresh
+        if not staged_sensitive_refresh.get("ok"):
+            payload["error"] = str(
+                staged_sensitive_refresh.get("error")
+                or "sensitive evidence staging receipt refresh failed"
+            )
+            payload["issues"] = [
+                {
+                    "code": str(
+                        staged_sensitive_refresh.get("reasonCode")
+                        or "SECRET_SCAN_RECEIPT_REFRESH_FAILED"
+                    ),
+                    "severity": "error",
+                    "message": payload["error"],
+                }
+            ]
+            _restore_finalize_failure()
+            return 1, payload
         staged_sensitive_gate = validate_sensitive_evidence_publication_gate(
             work_dir,
             copy_root=work_dir,
@@ -7608,13 +7666,6 @@ def cmd_finalize(
         _restore_finalize_failure()
         return 1, payload
 
-    if split_state_dir is not None and split_state_dir.is_dir():
-        _merge_runtime_state(split_state_dir, work_dir)
-        payload["steps"]["split_state_merge"] = {
-            "ok": True,
-            "stateDir": str(split_state_dir),
-        }
-
     def _safe_append(**kwargs: Any) -> None:
         nonlocal work_dir
         try:

package/harness/bundles/java/claude-code/scripts/harness_runtime.py

@@ -217,7 +217,7 @@ def sensitive_evidence_candidates(root: Path) -> list[dict[str, Any]]:
     return _sensitive_candidates(root)
 
 
-def _write_sensitive_scan_receipt(
+def _build_sensitive_scan_receipt(
     change_root: Path,
     *,
     entries: list[dict[str, Any]],
@@ -225,7 +225,7 @@ def _write_sensitive_scan_receipt(
     status: str,
 ) -> dict[str, Any]:
     change_root = change_root.expanduser().resolve()
-    receipt = {
+    return {
         "schemaVersion": 1,
         "rulesVersion": SECRET_SCAN_RULES_VERSION,
         "changeId": change_root.name,
@@ -236,6 +236,22 @@ def _write_sensitive_scan_receipt(
         "publicationExcluded": True,
         "recordedAt": now_iso(),
     }
+
+
+def _write_sensitive_scan_receipt(
+    change_root: Path,
+    *,
+    entries: list[dict[str, Any]],
+    unresolved: list[dict[str, Any]],
+    status: str,
+) -> dict[str, Any]:
+    change_root = change_root.expanduser().resolve()
+    receipt = _build_sensitive_scan_receipt(
+        change_root,
+        entries=entries,
+        unresolved=unresolved,
+        status=status,
+    )
     atomic_write_json(_sensitive_evidence_receipt_path(change_root), receipt)
     return receipt
 
@@ -364,6 +380,93 @@ def ensure_sensitive_evidence_scan_receipt(change_root: Path) -> dict[str, Any]:
     )
 
 
+def refresh_sensitive_evidence_scan_receipt(
+    change_root: Path,
+    *,
+    persist: bool = True,
+) -> dict[str, Any]:
+    """Rescan current bytes while preserving valid quarantine audit entries."""
+    change_root = change_root.expanduser().resolve()
+    receipt_path = _sensitive_evidence_receipt_path(change_root)
+    entries: list[dict[str, Any]] = []
+    if receipt_path.is_file():
+        try:
+            prior = json.loads(receipt_path.read_text(encoding="utf-8-sig"))
+        except (OSError, json.JSONDecodeError) as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+        if not isinstance(prior, dict):
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": "receipt must be an object",
+            }
+        prior_entries = prior.get("entries")
+        prior_unresolved = prior.get("unresolvedFailures")
+        valid_identity = (
+            prior.get("schemaVersion") == 1
+            and prior.get("rulesVersion") == SECRET_SCAN_RULES_VERSION
+            and prior.get("changeId") == change_root.name
+            and prior.get("publicationExcluded") is True
+            and str(prior.get("status") or "").upper()
+            in {"OK", "QUARANTINED", "FAIL"}
+        )
+        if (
+            not valid_identity
+            or not isinstance(prior_entries, list)
+            or not isinstance(prior_unresolved, list)
+        ):
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_INVALID",
+                "receiptPath": str(receipt_path),
+                "error": "receipt identity or collection fields are invalid",
+            }
+        entries = list(prior_entries)
+
+    unresolved = _sensitive_candidates(change_root)
+    status = "FAIL" if unresolved else "QUARANTINED" if entries else "OK"
+    if persist:
+        try:
+            receipt = _write_sensitive_scan_receipt(
+                change_root,
+                entries=entries,
+                unresolved=unresolved,
+                status=status,
+            )
+        except OSError as exc:
+            return {
+                "ok": False,
+                "reasonCode": "SECRET_SCAN_RECEIPT_REFRESH_FAILED",
+                "receiptPath": str(receipt_path),
+                "error": str(exc),
+            }
+    else:
+        receipt = _build_sensitive_scan_receipt(
+            change_root,
+            entries=entries,
+            unresolved=unresolved,
+            status=status,
+        )
+    return {
+        "ok": not unresolved,
+        "reasonCode": (
+            "SENSITIVE_EVIDENCE_UNQUARANTINED"
+            if unresolved
+            else "SECRET_SCAN_RECEIPT_REFRESHED"
+        ),
+        "receiptPath": str(receipt_path),
+        "receipt": receipt,
+        "persisted": persist,
+        "unresolvedFailures": unresolved,
+    }
+
+
 def _run_sessions_root(state_root: Path) -> Path:
     return state_root.expanduser().resolve() / "runtime" / "run-sessions"